Description
A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ovirt-engine | < 4.5.7 | 4.5.7 |
| Red Hat | Red Hat Virtualization 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | ovirt-engine +18 | 4.4.10.7-1.0.33.el8 | ELSA-2024-12701 |
Advisories 1
- ELSA-2024-12701 Moderate: ovirt-engine security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 30, 2024